CheckmarxOne DAST V2 Connector

Have the following ready before starting the connector configuration in Qualys ETM:

1. Ensure you have access to your Checkmarx One environment with permissions to create API keys.
2. Identify your Checkmarx One server base URL and note the region code — this is the Checkmarx Region value required during connector setup (for example, deu from https://deu.ast.checkmarx.net).
3. Note your Tenant Name (Tenant ID) associated with your Checkmarx One user profile.
4. Generate an API key in Checkmarx One. Navigate to Settings > Identity and Access Management > API Keys and click Create Key. Store the generated key securely.

Generate an API Key in Checkmarx One

1. Log in to your Checkmarx One environment using the appropriate regional URL (see the region table below).
2. Navigate to Settings > Identity and Access Management > API Keys.
3. Click Create Key.
4. Optionally configure a note description, expiration period, and notification emails.
5. Click Create and copy the generated API key immediately. Store it securely.

Reference: Creating OAuth Clients – Checkmarx Docs

Identify Your Checkmarx Region and Tenant Name

Your Checkmarx Region is the region code derived from your Checkmarx One server base URL. For example, if your environment URL is https://deu.ast.checkmarx.net, your region code is deu. Enter this region code (not the full URL) in the Checkmarx Region field in Qualys ETM.

Your Tenant Name is the Tenant ID associated with your Checkmarx One user profile.

Permissions Required

The Checkmarx One API key must have the read:vulnerabilities permission to access DAST vulnerability findings. This permission applies to the VulnerabilityFindings entity type.

Scope and Data Access

The connector calls three Checkmarx One API endpoints sequentially:

• Environments: /api/dast/scans/environments/
• Scans per environment: /api/dast/scans/scans?environmentId=<environmentId>
• Scan details: /api/dast/mfe-results/results/<scanId>

All data is fetched in full on each run. Import of installed software, source tags, and filter queries are not supported. The data flow is unidirectional, from Checkmarx One to Qualys ETM.

Key Rotation

When rotating the API key, generate a new key in Checkmarx One under Settings > Identity and Access Management > API Keys. Update the connector configuration in Qualys ETM with the new API key via the Edit Connector option.

This step establishes the connector's identity and authenticates it with your Checkmarx One environment.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the CheckmarxOne DAST V2 Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for the CheckmarxOne DAST V2 connector, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens with the Before You Begin checklist and four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before continuing.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Checkmarx One environment.

   Field	Type	Description
   Checkmarx Region (required)	String	The region code derived from your Checkmarx One base URL — not the full URL. Example: deu (from https://deu.ast.checkmarx.net). See the regional table above.
   Tenant Name (required)	String	The Tenant ID associated with your Checkmarx One user profile. Example: qualys-nfr
   API Key (required)	Encrypted String	The API key generated from Checkmarx One under Settings > Identity and Access Management > API Keys.

   
   

   Important: Enter the region code only (for example, deu), not the full URL. Entering the full URL in the Checkmarx Region field will cause a Network Reachability failure (Unknown Host error) during the connection test.

8. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies the Checkmarx One regional endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms a secure connection can be established.
   • Authentication Credential Check — Validates the API key, region code, and Tenant Name against the Checkmarx OAuth endpoint.
   • Authorization Scope Check — Confirms the API key has read:vulnerabilities permission on the VulnerabilityFindings entity.
   • Data Fetch — Verifies that DAST environment and scan data can be retrieved from the Checkmarx One API.

   Important: All five checks must pass before you can proceed. If Network Reachability fails with an Unknown Host error, verify that the Checkmarx Region value is the region code (for example, deu) and not the full URL. Confirm Qualys cloud can reach the Checkmarx One API endpoint over HTTPS (port 443).

   
9. Click OK to dismiss the modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — This connector supports Assets only. Vulnerability findings are always ingested as part of the asset sync. The default asset class is Application.
2. Advanced Settings (optional) — Click Advanced Settings to restrict which asset types are ingested or to view the active transform map. See Advanced Settings below.
3. Schedule — Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

   Note: The timezone is determined by your Qualys account settings. The connector runs from the configured start date for a default period of 5 years.

4. Click Next.
   
5. Review and confirm your changes and create the connector.